@app-vitals/agent-runtime 0.0.1 → 0.1.0

package/cutover-validate.integration.test.ts

@@ -0,0 +1,245 @@
+/**
+ * agent/src/runtime/cutover-validate.integration.test.ts
+ * Integration tests for cutover-validate using in-memory doubles.
+ * No database or network required — runs unconditionally.
+ */
+
+import { describe, expect, it } from "bun:test";
+import type {
+  AgentConfigResponse,
+  AgentCronJob,
+} from "@app-vitals/agent-admin";
+import {
+  type ShipwrightConfigClient,
+  validateCutover,
+} from "./cutover-validate.ts";
+
+// ─── Fixtures ─────────────────────────────────────────────────────────────────
+
+const AGENT_ID = "agent-cutover-test";
+
+function makeCron(id: string): AgentCronJob {
+  return {
+    id,
+    agentId: AGENT_ID,
+    schedule: "0 9 * * *",
+    prompt: "/shipwright:dev-task",
+    channel: "C123456",
+    user: null,
+    silent: false,
+    enabled: true,
+    preCheck: null,
+    name: "dev-task",
+    createdAt: new Date("2026-01-01"),
+    updatedAt: new Date("2026-01-01"),
+    system: false,
+    parentCronId: null,
+    lockdownDisabledAt: null,
+  };
+}
+
+function makeConfig(env: Record<string, string>): AgentConfigResponse {
+  return {
+    env,
+    allowedTools: [],
+    plugins: [],
+    repos: [],
+    reviewAuthorAllowlist: [],
+    patchAuthorAllowlist: [],
+    restrictSlackToMembers: false,
+    memberEmails: [],
+    autoPostReviews: true,
+    allowSelfReview: false,
+    minConfidence: 75,
+    maxFindings: 5,
+    cleanupMergedWorktrees: true,
+    cleanupAfterDays: 14,
+  };
+}
+
+// ─── Recorded double ──────────────────────────────────────────────────────────
+
+class RecordedShipwrightConfigClient implements ShipwrightConfigClient {
+  constructor(
+    private readonly config: AgentConfigResponse,
+    private readonly crons: AgentCronJob[],
+  ) {}
+
+  async getConfig(_agentId: string): Promise<AgentConfigResponse> {
+    return this.config;
+  }
+
+  async getCrons(_agentId: string): Promise<AgentCronJob[]> {
+    return this.crons;
+  }
+}
+
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+
+function makeAppAuthEnv(): Record<string, string> {
+  return {
+    SLACK_BOT_TOKEN: "xoxb-test-token",
+    GH_APP_ID: "12345",
+    GH_APP_PRIVATE_KEY:
+      "-----BEGIN RSA PRIVATE KEY-----\nfake\n-----END RSA PRIVATE KEY-----",
+    GH_APP_INSTALLATION_ID: "67890",
+  };
+}
+
+function makePatEnv(): Record<string, string> {
+  return {
+    SLACK_BOT_TOKEN: "xoxb-test-token",
+    GH_TOKEN: "ghp_faketoken123",
+  };
+}
+
+// ─── Tests ────────────────────────────────────────────────────────────────────
+
+describe("validateCutover", () => {
+  it("returns all passing when SLACK_BOT_TOKEN + GitHub App creds + crons present", async () => {
+    const client = new RecordedShipwrightConfigClient(
+      makeConfig(makeAppAuthEnv()),
+      [makeCron("cron-1")],
+    );
+    const results = await validateCutover(client, AGENT_ID);
+    expect(results.every((r) => r.passed)).toBe(true);
+  });
+
+  it("returns all passing when SLACK_BOT_TOKEN + GH_TOKEN (PAT) + crons present", async () => {
+    const client = new RecordedShipwrightConfigClient(
+      makeConfig(makePatEnv()),
+      [makeCron("cron-1")],
+    );
+    const results = await validateCutover(client, AGENT_ID);
+    expect(results.every((r) => r.passed)).toBe(true);
+  });
+
+  it("does NOT fail when SLACK_BOT_TOKEN is missing — a chat-only agent is a supported configuration", async () => {
+    const { SLACK_BOT_TOKEN: _s, ...env } = makeAppAuthEnv();
+    const client = new RecordedShipwrightConfigClient(makeConfig(env), [
+      makeCron("cron-1"),
+    ]);
+    const results = await validateCutover(client, AGENT_ID);
+    const slackCheck = results.find((r) => r.name === "SLACK_BOT_TOKEN");
+    expect(slackCheck).toBeDefined();
+    expect(slackCheck?.passed).toBe(true);
+    expect(slackCheck?.message).toContain("chat-only");
+    // The whole run still passes — nothing else depended on Slack.
+    expect(results.every((r) => r.passed)).toBe(true);
+  });
+
+  it("reports SLACK_BOT_TOKEN as present when it is set", async () => {
+    const client = new RecordedShipwrightConfigClient(
+      makeConfig(makeAppAuthEnv()),
+      [makeCron("cron-1")],
+    );
+    const results = await validateCutover(client, AGENT_ID);
+    const slackCheck = results.find((r) => r.name === "SLACK_BOT_TOKEN");
+    expect(slackCheck?.passed).toBe(true);
+    expect(slackCheck?.message).toBe("SLACK_BOT_TOKEN is present");
+  });
+
+  it("names no failing check when only SLACK_BOT_TOKEN is missing", async () => {
+    const { SLACK_BOT_TOKEN: _s, ...env } = makeAppAuthEnv();
+    const client = new RecordedShipwrightConfigClient(makeConfig(env), [
+      makeCron("cron-1"),
+    ]);
+    const results = await validateCutover(client, AGENT_ID);
+    expect(results.filter((r) => !r.passed)).toEqual([]);
+  });
+
+  it("fails when GitHub auth credentials are missing", async () => {
+    const client = new RecordedShipwrightConfigClient(
+      makeConfig({ SLACK_BOT_TOKEN: "xoxb-token" }),
+      [makeCron("cron-1")],
+    );
+    const results = await validateCutover(client, AGENT_ID);
+    const githubCheck = results.find((r) => r.name === "github_auth");
+    expect(githubCheck).toBeDefined();
+    expect(githubCheck?.passed).toBe(false);
+  });
+
+  it("fails when no crons are present", async () => {
+    const client = new RecordedShipwrightConfigClient(
+      makeConfig(makeAppAuthEnv()),
+      [],
+    );
+    const results = await validateCutover(client, AGENT_ID);
+    const cronCheck = results.find((r) => r.name === "crons");
+    expect(cronCheck).toBeDefined();
+    expect(cronCheck?.passed).toBe(false);
+  });
+
+  it("reports all failing checks when multiple checks fail", async () => {
+    const client = new RecordedShipwrightConfigClient(makeConfig({}), []);
+    const results = await validateCutover(client, AGENT_ID);
+    const failed = results.filter((r) => !r.passed);
+    expect(failed.length).toBeGreaterThanOrEqual(2);
+    const names = failed.map((r) => r.name);
+    expect(names).toContain("github_auth");
+    expect(names).toContain("crons");
+    // Slack is informational — an empty env does not fail it.
+    expect(names).not.toContain("SLACK_BOT_TOKEN");
+  });
+
+  it("passes with App id + key and no GH_APP_INSTALLATION_ID (the installation id is an optional pin)", async () => {
+    const env: Record<string, string> = {
+      SLACK_BOT_TOKEN: "xoxb-test-token",
+      GH_APP_ID: "12345",
+      GH_APP_PRIVATE_KEY: "some-key",
+      // GH_APP_INSTALLATION_ID intentionally omitted — discovered at runtime
+    };
+    const client = new RecordedShipwrightConfigClient(makeConfig(env), [
+      makeCron("cron-1"),
+    ]);
+    const results = await validateCutover(client, AGENT_ID);
+    const githubCheck = results.find((r) => r.name === "github_auth");
+    expect(githubCheck).toBeDefined();
+    expect(githubCheck?.passed).toBe(true);
+  });
+
+  it("fails when GH_APP_PRIVATE_KEY is missing (partial App creds)", async () => {
+    const env: Record<string, string> = {
+      SLACK_BOT_TOKEN: "xoxb-test-token",
+      GH_APP_ID: "12345",
+      GH_APP_INSTALLATION_ID: "67890",
+    };
+    const client = new RecordedShipwrightConfigClient(makeConfig(env), [
+      makeCron("cron-1"),
+    ]);
+    const results = await validateCutover(client, AGENT_ID);
+    const githubCheck = results.find((r) => r.name === "github_auth");
+    expect(githubCheck?.passed).toBe(false);
+    expect(githubCheck?.message).toContain("GH_APP_ID + GH_APP_PRIVATE_KEY");
+    expect(githubCheck?.message).not.toContain("+ GH_APP_INSTALLATION_ID");
+  });
+
+  it("fails when only disabled crons are present", async () => {
+    const disabledCron: AgentCronJob = {
+      ...makeCron("cron-disabled"),
+      enabled: false,
+    };
+    const client = new RecordedShipwrightConfigClient(
+      makeConfig(makeAppAuthEnv()),
+      [disabledCron],
+    );
+    const results = await validateCutover(client, AGENT_ID);
+    const cronCheck = results.find((r) => r.name === "crons");
+    expect(cronCheck).toBeDefined();
+    expect(cronCheck?.passed).toBe(false);
+  });
+
+  it("accepts GitHub App creds with only the three required fields", async () => {
+    const env: Record<string, string> = {
+      SLACK_BOT_TOKEN: "xoxb-test-token",
+      GH_APP_ID: "99999",
+      GH_APP_PRIVATE_KEY: "some-key",
+      GH_APP_INSTALLATION_ID: "11111",
+    };
+    const client = new RecordedShipwrightConfigClient(makeConfig(env), [
+      makeCron("cron-1"),
+    ]);
+    const results = await validateCutover(client, AGENT_ID);
+    expect(results.every((r) => r.passed)).toBe(true);
+  });
+});

package/cutover-validate.ts

@@ -0,0 +1,84 @@
+/**
+ * agent/src/runtime/cutover-validate.ts
+ * Validates that a shipwright agent is ready for cutover by checking the
+ * runtime API for required credentials and crons.
+ *
+ * Checks:
+ *  - SLACK_BOT_TOKEN reported (informational — absence means a chat-only agent,
+ *    which is a supported configuration, so this check never fails)
+ *  - GitHub auth credentials present (App: GH_APP_ID + GH_APP_PRIVATE_KEY,
+ *    with GH_APP_INSTALLATION_ID as an optional pin; or PAT: GH_TOKEN)
+ *  - At least one cron job configured
+ */
+
+import type {
+  AgentConfigResponse,
+  AgentCronJob,
+} from "@app-vitals/agent-admin";
+
+// ─── Types ────────────────────────────────────────────────────────────────────
+
+export interface ShipwrightConfigClient {
+  getConfig(agentId: string): Promise<AgentConfigResponse>;
+  getCrons(agentId: string): Promise<AgentCronJob[]>;
+}
+
+export interface CheckResult {
+  name: string;
+  passed: boolean;
+  message: string;
+}
+
+// ─── Validation ───────────────────────────────────────────────────────────────
+
+function hasGitHubAuth(env: Record<string, string>): boolean {
+  // GH_APP_INSTALLATION_ID is an optional pin — installations are discovered.
+  const hasAppCreds = Boolean(env.GH_APP_ID) && Boolean(env.GH_APP_PRIVATE_KEY);
+  const hasPat = Boolean(env.GH_TOKEN);
+  return hasAppCreds || hasPat;
+}
+
+export async function validateCutover(
+  client: ShipwrightConfigClient,
+  agentId: string,
+): Promise<CheckResult[]> {
+  const [config, crons] = await Promise.all([
+    client.getConfig(agentId),
+    client.getCrons(agentId),
+  ]);
+
+  const { env } = config;
+
+  const hasSlack = Boolean(env.SLACK_BOT_TOKEN);
+  const hasGithub = hasGitHubAuth(env);
+  const enabledCrons = crons.filter((c) => c.enabled);
+  const hasCrons = enabledCrons.length > 0;
+
+  return [
+    {
+      // Slack is an optional interaction surface, not a requirement: an agent
+      // with no Slack credentials runs in offline mode (agent/src/index.ts) and
+      // is driven from the admin chat UI instead. Absence is reported, not
+      // failed — otherwise every chat-only agent fails cutover by design.
+      name: "SLACK_BOT_TOKEN",
+      passed: true,
+      message: hasSlack
+        ? "SLACK_BOT_TOKEN is present"
+        : "SLACK_BOT_TOKEN is not set — chat-only agent (interact via /admin/chat)",
+    },
+    {
+      name: "github_auth",
+      passed: hasGithub,
+      message: hasGithub
+        ? "GitHub auth credentials are present"
+        : "GitHub auth credentials missing — need GH_TOKEN or GH_APP_ID + GH_APP_PRIVATE_KEY (GH_APP_INSTALLATION_ID optional pin)",
+    },
+    {
+      name: "crons",
+      passed: hasCrons,
+      message: hasCrons
+        ? `${enabledCrons.length} enabled cron job(s) configured`
+        : "No enabled cron jobs configured — at least one is required",
+    },
+  ];
+}

package/entrypoint-main.ts

@@ -0,0 +1,79 @@
+/**
+ * agent/src/entrypoint-main.ts
+ *
+ * Production CLI entry point — invoked by the Dockerfile ENTRYPOINT.
+ *
+ * Wires all real dependencies and calls runEntrypoint().
+ * Run via: bun run agent/src/entrypoint-main.ts [--agent-id X] [--api-url Y] [--api-key Z]
+ *
+ * The agent server (index.ts) runs as a subprocess (spawnAgentServer) and owns
+ * the single health server. Do NOT start a health server here too — index.ts
+ * binds the same port, so a second listener would fail with EADDRINUSE and crash
+ * the agent on startup.
+ */
+
+import { join } from "node:path";
+import { applyEnvToProcess } from "@app-vitals/agent-runtime/anthropic-federation-guard";
+import { parseCliArgs } from "@app-vitals/agent-runtime/cli-args";
+import { runEntrypoint } from "@app-vitals/agent-runtime/entrypoint";
+import { buildGitHubAuthDeps } from "@app-vitals/agent-runtime/github-auth-deps";
+import {
+  ensureDotClaudeSymlink,
+  installPlugins,
+  runMiseStartup,
+} from "@app-vitals/agent-runtime/setup";
+import { setupGitHubAuth } from "@app-vitals/agent-runtime/setup-github-auth";
+import { HttpShipwrightRuntimeClient } from "@app-vitals/agent-runtime/shipwright-runtime-client";
+
+const { agentId, apiUrl, apiKey } = parseCliArgs(
+  process.argv.slice(2),
+  process.env as Record<string, string | undefined>,
+);
+
+const agentHome =
+  process.env.AGENT_HOME ??
+  join(process.env.HOME ?? "/root", ".shipwright-agent");
+
+const runtimeClient = new HttpShipwrightRuntimeClient({
+  apiUrl: apiUrl ?? "",
+  apiKey: apiKey ?? "",
+});
+const configClient = {
+  getConfig: (id: string) => runtimeClient.getAgentConfigBundle(id),
+};
+
+const SCRIPTS_BIN = join(import.meta.dir, "..", "scripts", "bin");
+
+await runEntrypoint({
+  agentId,
+  apiUrl,
+  apiKey,
+  agentHome,
+  configClient,
+  // WIF-2.1: skips the Anthropic credential keys when federation is active.
+  applyEnv: (env: Record<string, string>) => applyEnvToProcess(env),
+  symlinkDotClaude: ensureDotClaudeSymlink,
+  setupGitHubAuth: async () => {
+    await setupGitHubAuth(buildGitHubAuthDeps(agentHome, SCRIPTS_BIN));
+  },
+  runMiseStartup,
+  installPlugins,
+  spawnAgentServer: (cmd: string, args: string[]) => {
+    // Detach — let the agent server run as the main process
+    const proc = Bun.spawn([cmd, ...args], {
+      stdio: ["inherit", "inherit", "inherit"],
+      env: process.env as Record<string, string>,
+    });
+    // Transfer control — wait for the server process to exit
+    proc.exited.then((code) => {
+      process.exit(code ?? 0);
+    });
+  },
+  exit: (code: number) => {
+    process.exit(code);
+  },
+  startupTimeoutMs: (() => {
+    const ms = Number(process.env.SHIPWRIGHT_STARTUP_TIMEOUT_MS);
+    return Number.isFinite(ms) ? ms : undefined;
+  })(),
+});